CWE-79
High likelihoodImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
45,478 vulnerabilities with CWE-79
CVE-2024-6158
MEDIUM
WordPress Plugin <4.9.17-4.9.13 - XSS
CVSS 4.8
CVE-2024-6134
MEDIUM
wp_estore < 8.5.6 - Reflected Cross-Site Scripting via Unsanitized Parameter
CVSS 5.4
CVE-2024-6133
MEDIUM
wp-cart-for-digital-products <8.5.6 - XSS
CVSS 6.5
CVE-2024-4360
MEDIUM
Element Pack Elementor Addons <= 5.7.6 - Authenticated Stored Cross-Site Scripting via Widget Title Tag Attribute
CVSS 6.4
CVE-2024-4350
MEDIUM
Concrete CMS < 8.5.18 and 9.0.0-9.3.2 - Authenticated Stored Cross-Site Scripting in RSS Displayer
CVSS 4.8
CVE-2024-41482
MEDIUM
Typora < 1.9.3 - Cross-Site Scripting via MathJax Component
CVSS 6.1
CVE-2024-41481
MEDIUM
Typora < 1.9.3 - Cross-Site Scripting via Mermaid Component
CVSS 6.1
CVE-2024-41476
CRITICAL
AMTT HiBOS < 3.0.3.151204 - SQL Injection via /manager/card/card_detail.php
CVSS 9.8
CVE-2024-40484
MEDIUM
PHPGurukul Old Age Home Management System v1.0 - XSS
CVSS 6.1
CVE-2024-40482
CRITICAL
Kashipara Live Membership System <1.0 - RCE
CVSS 9.8
CVE-2024-40481
MEDIUM
PHPGurukul Old Age Home Management System v1.0 - XSS
CVSS 5.4
CVE-2024-40478
MEDIUM
Kashipara Online Exam System v1.0 - XSS
CVSS 5.4
CVE-2024-40474
MEDIUM
SourceCodester House Rental Management System v1.0 - XSS
CVSS 5.4
CVE-2024-40473
MEDIUM
SourceCodester Best House Rental Management System v1.0 - XSS
CVSS 5.4
CVE-2024-7394
MEDIUM
Concrete CMS < 8.5.18 and 9.0.0-9.3.2 - Authenticated Stored Cross-Site Scripting in getAttributeSetName()
CVSS 4.8
CVE-2024-42366
CRITICAL
VRCX < 2024.03.23 - Remote Code Execution via CefSharp Browser Over-Permission and XSS
CVSS 9.0
CVE-2024-4207
MEDIUM
GitLab 5.1-17.0.5 17.1-17.1.3 17.2-17.2.1 - Cross-Site Scripting via XML File Rendering
CVSS 4.4
CVE-2024-6884
MEDIUM
Gutenberg Blocks with AI by Kadence WP < 3.2.39 - Stored Cross-Site Scripting via Block Options
CVSS 5.4
CVE-2024-6481
MEDIUM
Search & Filter Pro WordPress <2.5.18 - XSS
CVSS 4.8
CVE-2024-5226
MEDIUM
Fuse Social Floating Sidebar <= 5.4.10 - Authenticated Stored Cross-Site Scripting via SVG File Upload
CVSS 6.4
CVE-2024-5668
MEDIUM
FooBox < 2.7.28 - Authenticated DOM-based Stored Cross-Site Scripting via HTML Data Attributes
CVSS 6.4
CVE-2024-6254
MEDIUM
Brizy - Page Builder <= 2.5.1 - Cross-Site Request Forgery via Missing Nonce Validation
CVSS 4.3
CVE-2024-6892
MEDIUM
Journyx - Stored Cross-Site Scripting via Crafted Link
CVSS 6.1
CVE-2024-6706
MEDIUM
OpenWebUI - Cross-Site Scripting via Malicious Prompt
CVSS 6.1
CVE-2024-41239
MEDIUM
Responsive School Management System 3.2.0 - Stored Cross-Site Scripting via Class Name Parameter
CVSS 4.8
Details
Vulnerabilities
45,478
Exploit Likelihood
High